Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sp_Blitz - Skip checks where the login doesn’t have enough permissions #3292

Closed
erikdarlingdata opened this issue Jun 26, 2023 · 1 comment · Fixed by #3300
Closed

sp_Blitz - Skip checks where the login doesn’t have enough permissions #3292

erikdarlingdata opened this issue Jun 26, 2023 · 1 comment · Fixed by #3300
Assignees
@erikdarlingdata
Labels
enhancement sp_Blitz

Comments

@erikdarlingdata
Copy link
Contributor

Is your feature request related to a problem? Please describe.
I’m doing some work in a high security environment where most checks run but some things like hitting sys.traces and DBCC commands fail, etc.

Describe the solution you'd like
Check to see if the user is a sysadmin/has access to view traces before running some checks.

Describe alternatives you've considered
Embarrassment

Are you ready to build the code for the feature?
Yep, have a prototype 😮‍💨
@erikdarlingdata erikdarlingdata self-assigned this Jun 26, 2023
erikdarlingdata added a commit to erikdarlingdata/SQL-Server-First-Responder-Kit that referenced this issue Jul 2, 2023
@erikdarlingdata
Add some permissions checks to sp_Blitz
3900d6e 
Closes BrentOzarULTD#3292

This feels like a somewhat naïve set of checks. I don't know a ton about security.

It may clash when someone uses `EXECUTE AS` or signs the procedure for execution for lower-privileged users.

It's also incomplete at the moment, because I need to round up commands that touch system databases we may not have read permissions in.

I fully expect this to get rejected, but it got me error-free runs in a tightly locked down SQL Server environment.

If anyone has feedback, I'm happy to take it.
@erikdarlingdata erikdarlingdata mentioned this issue Jul 2, 2023
Merged
@BrentOzar
Copy link
Member

Thanks for the pull request! Made a couple tweaks, tested it on SQL Server 2022 as SA, and on an AWS RDS instance with the default sysadmin account, and works with the same result sets. I didn't try restricting permissions, but this is a good place to start.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@erikdarlingdata erikdarlingdata

Labels
enhancement sp_Blitz
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add some permissions checks to sp_Blitz erikdarlingdata/SQL-Server-First-Responder-Kit
2 participants
@BrentOzar @erikdarlingdata